CVE-2026-28683 Gokapi: Stored XSS in SVG Hotlinks

What is CVE-2026-28683?

CVE-2026-28683 is a high-severity cross-site scripting vulnerability in Forceu Gokapi, published on 6 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if a malicious authenticated user uploads SVG and creates a hotlink for it, they can achieve stored XSS. This issue has been patched in version 2.2.3.

Weakness: CWE-79

Which versions are affected by CVE-2026-28683?

3 open source packages ship an affected version, including github.com/forceu/gokapi. It affects 1 product.

Products include Forceu Gokapi.

How do I fix CVE-2026-28683?

Upgrade github.com/forceu/gokapi to 2.2.3 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-28683 being exploited?

There is no known exploitation of CVE-2026-28683 in the wild and no public exploit code.

Other vulnerabilities in Forceu Gokapi

• CVE-2026-30955 Gokapi vulnerable to DoS in E2E Metadata Parser Medium 6.5
• CVE-2026-28682 Gokapi: Data Leak in Upload Status Stream Medium 6.4
• CVE-2026-29061 Gokapi: Privilege escalation via incomplete API-key permission revocation on user rank demotion Medium 5.4
• CVE-2026-29060 Gokapi: Privilege escalation with auth token Medium 5.0
• CVE-2025-48494 Gokapi vulnerable to stored XSS via uploading file with malicious file name Medium 4.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3c22-5j5m-4jq7, GO-2026-4612.